Researchers reveal VoIP vulnerabilities

Share this article:
VoIPshield Laboratories has alerted companies that market voice over IP systems of new security vulnerabilities.

The VoIP vulnerabilities, if successfully exploited, could affect brand reputation, internal productivity, and competitive advantage, researchers said.

VoIPshield does not reveal specifics about the vulnerabilities to the public, Bogdan Materna, VoIPshield Laboratories chief technology officer, told SCMagazineUS.com on Friday.

“We don't want to give hackers information to work from,” he said.

Instead, under its disclosure policy, VoIPshield works with the VoIP vendors to assist them in reproducing the vulnerabilities in their labs.

VoIPshield classifies the vulnerabilities into different categories -- remote code execution; unauthorized access; denial of service; and information harvesting – and rates them according to their severity.

Materna said that by passing the information of their vulnerability research, the company hopes that vendors will be able to take action to create patches for potential exploits. Avaya, Cisco and Nortel have acknowledged the latest vulnerabilities on their websites, and are issuing their own security advisories.

VoIP vulnerabilities appear to be increasing because more security researchers are focused on finding them, Lawrence Orans of Gartner told SCMagazineUS.com.

“Three to four years ago, there was far less focus on IP telephony vulnerabilities because the IP telephony installed base was much smaller,” Orans said. "In 2008, most of the widely deployed telephony systems have vulnerabilities that permit DOS attacks, privilege escalation and code execution attacks."

Because of these risks, he added, managers should scan their applications for vulnerabilities on a regular basis and prioritize software patches that resolve critical vulnerabilities.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

TOP COMMENTS

More in News

Adobe exploit used to spread Dyre credential stealer

Adobe exploit used to spread Dyre credential stealer

Users running vulnerable Adobe software could be in danger of having credentials for Bitcoin websites stolen.

Staples is investigating a potential issue involving credit card data

Staples is investigating a potential issue involving credit ...

The company said it is investigating a potential issue involving credit card data and that customers are not responsible for fraudulent activity on cards if an issue is discovered.

Skills set a priority over legacy prejudices, experts say

Skills set a priority over legacy prejudices, experts ...

Cybersecurity expert Winn Schwartau and Robert Clark, a cyber law attorney at the Army Cyber Institute, discussed issues around hiring in the information security industry.